next »

[Shaun LeBron]

I just registered with this forum, and it appears my password was stored in plaintext, at least until it was emailed to me.  That is not okay.

A hashed password should be stored, never the password itself.

I will refer to this discussion for more details:
http://security.stackexchange.com/questions/17979/is-sending-password-to-user-email-secure

Is this the correct channel for communicating this security issue?

[Christian Knudsen]

I believe SMF 1.1.17 stores hashed passwords.

[Kemp]

Sorry about necro'ing this thread, but this isn't exactly an active forum anyway

This was my concern as well and I'm glad someone else has already pointed this out. Historically, sites that have emailed out passwords (other than randomly generated temporary ones) have done very *very* badly on security.

Storing the password in hashed form is an absolute requirement, so I hope "I believe" means you've confirmed that it does. Sending out in plain text in an email is still bad form though, as it's open to very simple interception, not to mention someone simply looking over your shoulder or looking at an email on a device you left logged in.

I would strongly encourage you to stop sending out the password and to be sure that passwords are not stored in plain text.

[Christian Knudsen]

Historically, sites that have emailed out passwords (other than randomly generated temporary ones) have done very *very* badly on security.

I often see SMF forum software mentioned as some of the most secure.

Storing the password in hashed form is an absolute requirement, so I hope "I believe" means you've confirmed that it does.

It means that SMF by default hashes and salts passwords (this information is easy to find by googling), but I'm not the admin of this forum (though I don't see why anybody would change that default behaviour to something worse).

Sending user-generated passwords in emails is bad form, though (newer versions of SMF don't do this).

[Matthew]

Yes, passwords are emailed to you in plaintext by the forum software when you register.  I guess SMF devs had their reasons for doing that, although it is a weird choice.

No, your password is not stored in plaintext, but in a hashed+salted fashion with SHA-1 (you cannot, for instance, have your password emailed to you at a later time if you forget your password).